Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

12/11/2019
02:00 PM
Joshua Goldfarb
Joshua Goldfarb
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
50%
50%

5 Tips for Keeping Your Security Team on Target

In nearly every security environment, competing priorities are a constant battleground. Here's how to keep the focus on what's important.

When I sit down to write an article, I encounter any number of distractions. Each distraction seems to want nothing more than to keep me from writing. But my distractibility is not limited to writing. I also encounter a near-constant stream of distractions when I sit down to do most any task.

What does this have to do with security? In security, as we go about the business of protecting our organizations, most of us face a near-constant stream of distractions. If we allow those distractions to drive our day-to-day work, we can very quickly lose focus, which in turn weakens our security postures by preventing us from tackling the items that are most relevant and important.

In this piece, I'd like to share five steps for keeping your security program on target and on track:

Step 1: Build a framework. I've noticed over the course of my career that the people who seem to be busy and overwhelmed all of the time are the same ones who are extremely disorganized. Although getting and staying organized requires an investment in time, in the long run, the investment will pay huge dividends. This is particularly the case with respect to evaluating what activities your security organization should engage in. Building a framework to formalize how the security team encounters new ideas and possibilities, evaluates them, and decides whether and how to approach them is essential to staying on target because it reduces the chance that the organization will be led astray by more attractive distractions.

Step 2: Develop good processes and procedures. It is far too easy to get sidetracked: A security analyst spends far too much time on dead-end leads during analysis and investigation, or a member of the governance, risk, and compliance team is overly focused on a specific control or policy whose impact is marginal. Perhaps the vulnerability team wastes time uncovering vulnerabilities without considering the necessary context that would allow them to prioritize and address the most important ones with IT. Whatever the example, having mature processes and procedures is a great way to avoid many of these potential time traps and ensures that the security program stays focused on what's important..

Step 3: Maintain a strategic direction. To ensure that your security program is on course, it generally helps to have a well-defined vision and strategic direction. This statement may sound obvious, but far too many security teams ignore these essential guiding forces. If you take a step back and think about it, it seems foolish to expect your team members to choose the right path when they lack the fundamental criteria against which to evaluate each potential direction. The board, executives, and security leadership should all have a vision for how they want the organization to defend itself against the most concerning risks. That vision should be documented and communicated, along with the organization's strategy to realize the vision. These documents should be readily accessible and in the foreground of each team member's thinking. This ensures that members of the security team will have a strong foundation upon which to evaluate data points as they encounter them and make the appropriate decisions.

Step 4: Stick to goals and priorities. Vision and strategy are great strategic-level tools, but they don't help us stay on track at the operational and tactical levels, where each functional area needs well-defined goals and priorities to chart and maintain a course of action. It's important to take the time to set goals and priorities for each functional area in line with the security organization's broader vision and strategy. Those goals and priorities should then be documented in detail and used as criteria for decision-making and prioritization of day-to-day activities. Before any decisions are to be made, the data points should be evaluated against specific criteria. Will going in this particular direction help us achieve our goals? Is this activity a good use of time, and is it in line with our priorities? Does the endeavor help improve the security posture of the organization? If the answer to any of these questions is no, what's being proposed is likely not worth the effort.

Step 5: Objectively evaluate impact. In nearly every security environment, competing priorities are a constant. With limited human resources, budget, and technical capabilities, each potential undertaking needs to be evaluated against its potential impact to the organization. If a task, assignment, or project seems like a great idea and a wise use of resources, ask yourself if that activity will directly impact the organization in a positive manner. Will the undertaking improve the security posture of the organization? If so, how can that impact be measured? At what cost will that impact come? If the answers to any of these questions seem uncertain, it's likely that you'll need further analysis before making a decision to engage.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Criminals Hide Fraud Behind the Green Lock Icon."

Josh (Twitter: @ananalytical) is an experienced information security leader who works with enterprises to mature and improve their enterprise security programs.  Previously, Josh served as VP, CTO - Emerging Technologies at FireEye and as Chief Security Officer for ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/5/2020
How AI and Automation Can Help Bridge the Cybersecurity Talent Gap
Peter Barker, Chief Product Officer at ForgeRock,  6/1/2020
Cybersecurity Spending Hits 'Temporary Pause' Amid Pandemic
Kelly Jackson Higgins, Executive Editor at Dark Reading,  6/2/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: What? IT said I needed virus protection!
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13881
PUBLISHED: 2020-06-06
In support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used.
CVE-2020-13883
PUBLISHED: 2020-06-06
In WSO2 API Manager 3.0.0 and earlier, WSO2 API Microgateway 2.2.0, and WSO2 IS as Key Manager 5.9.0 and earlier, Management Console allows XXE during addition or update of a Lifecycle.
CVE-2020-13871
PUBLISHED: 2020-06-06
SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.
CVE-2020-13864
PUBLISHED: 2020-06-05
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability. An author user can create posts that result in a stored XSS by using a crafted payload in custom links.
CVE-2020-13865
PUBLISHED: 2020-06-05
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. An author user can create posts that result in stored XSS vulnerabilities, by using a crafted link in the custom URL or by applying custom attributes.